Intelligence Feed

2mo ago · hacker-news

Microsoft has uncovered a new variant of the ClickFix campaign dubbed TerminalFix, which uses social engineering to trick users into executing a malicious PowerShell command via fake Cloudflare CAPTCHA pages served through compromised websites. The attack employs DLL sideloading using a legitimate binary and a malicious DLL to execute multi-stage payloads, including steganographic extraction from PNG files and extensive Active Directory reconnaissance. The final payload is a Python-based reverse-tunnel backdoor that establishes persistent C2 access via an encrypted WebSocket, enabling attackers to pivot across internal networks. This campaign poses a serious risk to enterprise environments due to its lateral movement and persistence capabilities.

2mo ago · hacker-news

A China-nexus cyber espionage group tracked as Fire Ant has expanded its operations to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts, enabling credential theft, traffic interception, and suppression of security telemetry. The group deployed custom malware including TacTap, a library injector targeting the tac_plus authentication process, and BridgeAgent, a Linux backdoor disguised as a Zabbix agent. The attackers manipulated router configurations to hide malicious GRE tunnels and exfiltrated packet captures to external FTP servers, while also obfuscating stolen credentials using XOR encryption. The campaign shows strong overlap with UNC3886, though definitive attribution remains unconfirmed.

2mo ago · hacker-news

Aurora ransomware operators, a Russian-speaking cybercrime group, have been leveraging SpaceX's AI-powered coding assistant Cursor to plan and execute attacks against at least 10 organizations between April and May 2026. The group used Cursor to assist in attack planning, including Active Directory Certificate Services exploitation, and conducted hands-on exploitation using credentials or existing access. The attack chain includes initial access via email bombing and social engineering, lateral movement using SMB, LDAP, RDP, and RPC, privilege escalation, evasion of security tools, data exfiltration, and deployment of a multi-platform encryptor written in Zig. A related AI-assisted toolkit called Gryxa has also emerged, enabling persistent access, credential theft from Chromium browsers, and evasion of endpoint protection.

2mo ago · hacker-news

North Korean threat actors, operating under multiple aliases including PurpleDelta, Jasper Sleet, and Wagemole, are conducting a large-scale job fraud campaign to infiltrate global companies in IT, healthcare, sales, and other sectors. These actors use forged identities, AI-generated profiles, and synthetic personas to gain remote employment, often using laptop farms equipped with PiKVM and Guermok USB devices to maintain control. They leverage tools like AnyDesk, Telegram, and Slack for coordination, and abuse legitimate platforms such as Workday, Zoom, and Microsoft Teams during recruitment and employment, posing significant insider threat and sanctions compliance risks.

2mo ago · bleeping-computer

The city administration of Berlin has confirmed a ransomware attack by the Rhysida group, which claims to have exfiltrated 5.79 TB of data from its administrative network. The stolen data includes sensitive government records, personal information, credentials, and critical infrastructure assessments, with attackers threatening to publish the data unless a ransom is paid. The incident was discovered in mid-August 2026, and investigations are ongoing, involving the State Criminal Police Office, public prosecutor, and federal security agencies. No evidence was found that election data was compromised, and the affected departments were disconnected from the state network on August 14.

2mo ago · bleeping-computer

The Chinese state-sponsored threat actor Fire Ant has shifted tactics to compromise Cisco IOS XR routers, TACACS servers, and Linux management systems, turning routers into surveillance platforms via concealed GRE tunnels. The group deployed a custom backdoor named 'BridgeAgent', disguised as a Zabbix agent, enabling reverse shells and execution of additional payloads. Fire Ant uses stealthy persistence mechanisms, suppresses syslog messages, and exfiltrates network traffic PCAPs to FTP servers, aiming to map and access high-value networks through a 'target behind the target' strategy. The group's activity overlaps with UNC3886 but shows distinct implementation differences.

2mo ago · bleeping-computer

Microsoft has identified a new variant of ClickFix attacks dubbed TerminalFix, which uses fake Cloudflare CAPTCHA prompts on compromised websites to trick users into executing malicious PowerShell commands in Windows Terminal. The attack chain involves downloading a ZIP containing a signed executable and a malicious DLL, followed by steganographic retrieval of additional payloads from PNG images. A custom Python-based reverse-tunnel module establishes an encrypted WebSocket connection to gitnow[.]dev:443, enabling attackers to pivot into internal networks via SOCKS5-style proxying and perform reconnaissance on domain controllers, databases, and other critical systems.

2mo ago · bleeping-computer

The Cronos blockchain was exploited via a price-manipulation attack on the Tectonic DeFi lending platform, resulting in the attacker borrowing $74 million worth of assets by artificially inflating the value of the TONIC token by 100x within 20 minutes. The attacker successfully withdrew approximately $6 million in Ethereum, while the remainder of the funds were frozen due to the blockchain's emergency response. Cronos halted operations, rolled back the chain state to before the exploit occurred, and has since resumed normal operations. A post-mortem analysis is expected to follow.

2mo ago · bleeping-computer

Pokémon Center disclosed a data breach affecting customers in the United Kingdom and Germany due to a cyberattack on its third-party logistics provider, CEVA Logistics, which was compromised between July 29 and August 1, 2026. The breach exposed customer personal information including full names, mailing addresses, phone numbers, email addresses, and order details. Although payment card data was not accessed, the incident led to order cancellations and shipping delays. CEVA Logistics, a subsidiary of CMA CGM Group, confirmed the breach impacted multiple European retailers, including Valve, which also reported stolen customer data.

2mo ago · hacker-news

GitLab has patched a critical vulnerability, CVE-2026-19478, affecting its self-managed Community and Enterprise Editions, which could allow unauthenticated attackers to remotely modify or delete public projects and user data under certain conditions. The flaw exists in the GraphQL implementation and can be exploited over the network without authentication or user interaction. The vulnerability impacts versions 18.2 to 18.11.10, 19.0 to 19.0.7, 19.1 to 19.1.5, and 19.2 to 19.2.3. A second high-severity issue, CVE-2026-19650, was also fixed, involving a CSRF vulnerability in the GraphQL multiplex query handler that allows unauthenticated mutation execution via GET requests under certain conditions.

2mo ago · hacker-news

Evooo1Bot is a newly identified Linux botnet derived from Mirai source code that targets internet-facing edge devices by exploiting known vulnerabilities. It installs a SOCKS5 proxy on compromised systems, enabling threat actors to route traffic through infected devices for evasion and anonymity. The malware includes an exploit toolkit targeting multiple CVEs, performs anti-analysis checks, and communicates with C2 servers over encrypted channels on port 443. It supports various post-compromise actions including DDoS attacks, credential sniffing, SSH brute-forcing, and lateral movement.

2mo ago · hacker-news

Iranian nation-state actors linked to Cavern (aka Cav3rn) C2 framework have evolved their infrastructure to blend malicious traffic with legitimate services, using DNS A-record queries to dynamically switch between direct HTTPS and Google Apps Script relays for command-and-control. A new module, HOLLOWGRAPH, abuses Microsoft 365 calendars via the Graph API to exfiltrate data and receive commands, with events scheduled far into the future to avoid detection. The framework uses a modular architecture with components like GoogleService.dll and rnp.dll, leveraging legitimate cloud services to evade perimeter defenses and maintain persistence.

2mo ago · hacker-news

A critical vulnerability, CVE-2026-15748, exists in the Forminator Forms WordPress plugin that allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution on vulnerable sites. The flaw affects all versions prior to and including 1.56.1 and stems from insufficient file type validation in the 'handle_file_upload()' function, which can be bypassed using alternative MIME types. Exploitation is possible when a form contains both a File Upload and a Select field, and custom upload directories without proper .htaccess protection increase the risk of successful code execution.

2mo ago · hacker-news

A workflow injection vulnerability was discovered in Snowflake's public GitHub repository 'snowflakedb/snowflake-connector-net' that allowed a crafted GitHub issue to trigger command injection in a CI/CD pipeline. The vulnerable workflow (.github/workflows/jira_issue.yml) directly embedded untrusted issue data into a shell run block, exposing internal Jira credentials including an API token. Researchers from Wiz exploited the flaw during authorized testing, successfully retrieving the Jira API token, which granted read access to internal engineering and security projects. The vulnerability was introduced via a commit on August 25, 2025, and was fixed on June 23, 2026, after being reported via HackerOne; no evidence of external exploitation was found.

2mo ago · bleeping-computer

A threat actor using the alias 'TheHatman' is selling alleged employee databases stolen from the Microsoft Azure environments of multiple Fortune 500 companies, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The actor claims to have obtained the data using compromised credentials, potentially via password spray and MFA fatigue attacks. The datasets reportedly include employee names, email addresses, job titles, phone numbers, addresses, service accounts, and tenant-specific Azure structures. While some companies like Tata and Gap have stated there is no evidence of a breach and that the data may be outdated, cybersecurity firm Hudson Rock has analyzed samples and confirmed the data contains authentic corporate directory attributes and could be used for social engineering or spearphishing.

2mo ago · wiz

Wiz Research's AI-powered Red Agent discovered a critical script injection vulnerability in a GitHub Actions workflow within Snowflake's public repository snowflakedb/snowflake-connector-net. The vulnerability was introduced on June 18, 2026, via an AI-generated 'autofix' commit that removed safe input handling, allowing unauthenticated users to execute arbitrary commands by opening a maliciously titled GitHub issue. Wiz successfully exploited the flaw to exfiltrate Snowflake's Jira API token, which granted read access to internal engineering and security projects. Snowflake patched the workflow, rotated credentials, and confirmed no unauthorized access occurred beyond Wiz's testing.

2mo ago · hacker-news

Multiple active threats were reported this week, including exploitation of critical vulnerabilities in VMware, Apple macOS, and GeoServer, as well as ongoing campaigns by state-linked actors. A suspected China-nexus APT exploited CVE-2026-59310 in VMware vCenter to deploy Babuk-derived ransomware, likely as a forensic distraction. The Lazarus Group leveraged a Windows zero-day (CVE-2026-68820) in a campaign dubbed Operation Dream Job, targeting aerospace and defense sectors. GeoServer faced active exploitation of a critical SQL injection flaw prior to patching. Additionally, new macOS malware Amnesia Stealer enables real-time browser hijacking via Chrome DevTools Protocol, stealing authenticated sessions and sensitive data.

2mo ago · bleeping-computer

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.

2mo ago · hacker-news

SpecterOps has detailed a post-exploitation technique leveraging the Chrome DevTools Protocol (CDP) to hijack authenticated browser sessions in live Google Chrome or Microsoft Edge processes on Windows. The technique requires prior code execution and manipulates the running browser process to enable remote debugging via a Beacon Object File (BOF), allowing attackers to extract cookies, saved passwords, browsing history, and perform browser takeover. The method bypasses protections like App-Bound Encryption by operating within the victim's existing browser context, and relies on process injection into chrome.exe or msedge.exe, detectable via Sysmon Event IDs 8 and 10.

2mo ago · hacker-news

The threat actor Mustang Panda, also known as HoneyMyte, has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit to enhance stealth. The rootkit, deployed as msagent.sys, is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. and enables hiding of malicious processes, files, registry entries, and C2 network activity. The malware is typically deployed after initial compromise via PlugX and uses DLL sideloading through a legitimate Sangfor executable to execute malicious components and establish persistence.

2mo ago · hacker-news

Threat actor Sable Squirrel has spent nearly $7 million acquiring expired domains to exploit their inherited reputation, traffic, and backlinks for illegal sports streaming, online gambling promotion, and malware distribution. The group operates a dual-purpose infrastructure where re-registered domains serve both as streaming platforms and command-and-control (C2) servers for malware such as Quasar RAT and HiddenTear ransomware. The operation targets users in Asia and Australia through social media and ad networks, using a traffic distribution system to redirect victims while evading detection. Additional scavenger actors like Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel are also abusing expired domains for ad fraud, tech support scams, and traffic resale.

2mo ago · hacker-news

A critical authentication vulnerability in Apple macOS Screen Sharing, tracked as CVE-2026-65400 (CVSS 9.8), is under active exploitation to deploy Monero cryptominers on internet-exposed Mac systems. The flaw allows unauthorized remote authentication to the Screen Sharing service without valid credentials, enabling attackers to gain root access and install malware. The Netherlands NCSC reported confirmed attacks where systems with port 5900 exposed were compromised. Apple has released emergency patches in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. A separate but related pre-authentication flaw in the same component was also patched, both residing in the same codebase and exploitable with minimal effort.

2mo ago · hacker-news

A critical vulnerability in SAP Commerce Cloud, tracked as CVE-2026-58231 and rated 10.0 on the CVSS scale, is being actively exploited just days after the patch was released. The flaw stems from insufficient authorization checks and input validation, allowing unauthenticated attackers to execute arbitrary code and compromise internal components. Exploitation attempts were detected by Defused Cyber on honeypot systems three days post-patch, despite the absence of a public proof-of-concept. SAP customers are urged to patch immediately or apply IP filtering as a temporary mitigation.

2mo ago · hacker-news

A suspected China-nexus advanced persistent threat (APT) has exploited CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter, to gain remote code execution and deploy a Babuk-derived ransomware. The attackers used the flaw to execute arbitrary code as root, deploy backdoors such as 'linuxFile', establish persistence via cron and systemd, and create malicious accounts. The campaign targeted 361 unique IP addresses across 47 countries, with evidence of operational patterns aligned with the UTC+08:00 timezone and use of Chinese-language tools and artifacts.

2mo ago · hacker-news

Security researchers at SSD Secure Disclosure disclosed a two-stage exploit chain that enables full Android kernel access on devices using Unisoc modem firmware via a VoLTE video call. The chain begins with a remote code execution vulnerability in the modem firmware (disclosed in March 2026), followed by a privilege escalation exploit that leverages improper isolation of shared resources (CWE-1189) to gain kernel-level access. The attacker must control a private 4G network and trick the victim into answering a video call. No CVE has been assigned, and no patch is available from Unisoc or device manufacturers. The vulnerability affects multiple Unisoc chipsets used in Motorola, Realme, and Xiaomi devices.

2mo ago · bleeping-computer

The Clop ransomware gang is conducting data theft attacks against organizations using PTC Windchill and PTC FlexPLM platforms, exploiting a critical vulnerability, CVE-2026-12569, that allows improper input validation. Companies including Philips, General Electric (GE), and Shell have confirmed they are investigating or have confirmed breaches. The attackers deploy JSP webshells to exfiltrate sensitive data such as project plans, blueprints, and internal backups. The U.S. CISA and Germany's BSI have issued urgent warnings, mandating immediate patching due to active exploitation in the wild.

2mo ago · bleeping-computer

Microsoft is actively working on a security patch for a newly disclosed zero-day vulnerability in Microsoft Defender named 'ShieldBreak', tracked as CVE-2026-69414. The vulnerability, disclosed by security researcher Nightmare Eclipse, allows local attackers with limited privileges to escalate to SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit acts as a bypass for the previously patched RoguePlanet vulnerability (CVE-2026-50656), indicating an incomplete fix. Microsoft has acknowledged the issue but has not yet released a patch, while the researcher has publicly released a proof-of-concept exploit due to an ongoing dispute over disclosure practices.

2mo ago · bleeping-computer

The French Ministry of the Economy and Finance disclosed a data breach affecting 678,000 individuals after a threat actor using the handle 'ZeroBytes' claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, 2026. The attacker accessed the General Directorate of Public Finances (DGFiP) systems, extracting sensitive tax and cadastral data, including reference tax income, family quotient, withholding tax rate, company names, SIREN numbers, and property records. Access to sensitive systems was shut down, and the incident is under investigation with support from ANSSI, though user credentials were not compromised.

2mo ago · bleeping-computer

Cryptocurrency hardware wallet provider SafePal suffered a data breach affecting approximately 39,798 customers due to an authorization flaw in an order-tracking plugin, which allowed unauthorized access to customer order information. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet seed phrases, private keys, or payment information. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and customers have reported receiving phishing emails and phone calls impersonating SafePal, warning of a firmware vulnerability in the X1 device to trick users into compromising their wallets.

2mo ago · bleeping-computer

Threema, a secure messaging service, was disrupted by large-scale distributed denial-of-service (DDoS) attacks that targeted both its infrastructure and its colocation partner, Nine. The attacks caused intermittent outages and service degradation for users in Switzerland, India, and China, despite internal status pages showing normal operations. The threat actor continuously changed attack patterns, making mitigation difficult, and an unrelated technical issue prevented timely status updates. Threema has since implemented specialized upstream DDoS protection to reduce future impact.